Beveiligingsadvies

CVE-2026-92458

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-09-16 11:07:28

Laatst bijgewerkt 2026-09-16 11:07:28

Toegewezen door VulnCheck

CVSS-score 5.3

Status PUBLISHED

Beschrijving

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product sale status. Attackers can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs to withdraw entire product catalogs from sale or re-enable withdrawn products without proper permission checks.

← Alle CVE's bekijken Bekijk op cve.org ↗